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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

1 . (Currently Amended) A server configured to send outgoing electronic 
messages on behalf of terminals connected thereto and to deliver incoming electronic 
messages to the terminals, each terminal being accessed by one or more users, the server 
comprising: 

receiving means arranged to generate or receive log data relating to one or more 
traffic characteristics associated with electronic messages; 

analysing analyzing means arranged to anaiyse analvze the log data in accordance 
with a predetermined criterion, so as to identify those electronic messages that satisfy the 
criterion; 

identifying means arranged to identify the destination of the identified electronic 
messages; and 

processing means arranged to send a message to each of the identified 
destinations, requesting suspension of delivery of the identified electronic messages. 

2. (Currently Amended) A server according to claim 1, including^ 

first means arranged to receive a signal identifying whether or not an identified 
electronic message is related to an electronic message virus, and 
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second means arranged to receive data indicative of the success or otherwise of the 
request, and, in the event that the received signal identifies an electronic message to be a 
virus and the request is successful, to trigger deletion of the said electronic message. 

3. (Currently Amended) A server according to claim 2, wherein^ 

in the event that a received signal identifies an electronic message to be a virus 
and the request is unsuccessful, the second means is arranged to trigger operation of 
identifying means and processing means running on a server corresponding to the 
destination of the identified electronic message. 

4. (Currently Amended) A server according to claim 2, wherein^ 

in the event that a received signal identifies an electronic message not to be a virus 
and the request is successful, the second means is arranged to permit delivery of the 
identified electronic message. 

5. (Currently Amended) A server according to claim 1, including; 
first storage for storing details relating to such electronic messages; 
further storage for storing a mapping between users and the 

orgaiiisational organizational units to which the users belongs 

display means for displaying a plurality of images, each representative of an 

organisational organizational unit; 

wherein the server is arranged, in use, such that in response to a request for data 

relating to a user, the first storage is arranged to output data identifying electronic 

messages emanating from that user; the further storage is arranged to output data 
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identifying which of the organisational organizational units that user belongs to; and, for 
those electronic messages that are identified to satisfy the criterion, the display means is 
arranged to insert, on the image corresponding to the identified 

organisational organizational unit, a visual identifier representative of the volume or type 
of identified electronic messages. 

6. (Currently Amended) A server according to claim 5, wherein^ 

for those electronic messages that are identified to satisfy the criterion, the display 
means is arranged to display a list of users on an associated image, and for each user on 
the list, to display details of the volume and/or type of identified electronic messages 
emanating therefrom. 

7. (Currently Amended) A server according to claim 6, wherein: 

the display means is arranged to insert a link between the identified organisational 
organizational unit and the organisational organizational unit corresponding to the 
identified destination. 

8. (Currently Amended) Apparatus for delivering electronic messages, 
comprising a plurality of servers according to claim If wherein at least one of the servers 
comprises: 

receiving means arranged to receive a request to suspend delivery of an identified 
electronic message; 
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polling means arranged to check whether or not the identified electronic message 
has been delivered, and if it has not, to block retrieval thereof by a respective terminal 
connected thereo; 

wherein, in response to receipt of a said request, the polling means is arranged to 
check delivery of the identified electronic message, and in the event that it has not been 
delivered, to block retrieval thereof. 

9. (Currently Amended) Apparatus according to claim 8, wherein: the at least 
one server includes deleting means for deleting an electronic message, and, 

in response to receipt of a signal identifying that an identified electronic message 
is related to an electronic message virus, the deleting means is arranged to check whether 
retrieval of the identified electronic message has been blocked, and if it has, to delete it. 

10. (Currently Amended) Apparatus according to claim 8, wherein^ 

in the event that the identified electronic message is related to an electronic 
message virus, and the identified electronic message has not been blocked, the server is 
arranged to invoke its identifying means and processing means in respect of electronic 
messages sent by the identified destinations. 

1 1 . (Currently Amended) Apparatus according to claim 1, wherein: 

the criterion includes an yat least one , or some, of type of (a) electronic message, 
(b) size of electronic message and (c) number of electronic messages emanating from a 
user. 
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12. (Currently Amended) A method of controlling propagation of electronic 
messages through a network, the network comprising a plurality of servers configured to 
send outgoing electronic messages on behalf of terminals connected thereto and to deliver 
incoming electronic messages to the terminals, each terminal being accessed by one or 
more users, the method comprising; 

receiving or generating traffic log data relating to one or more traffic 
characteristics associated with electronic messages sent from, or received at, a said 
server; 

analysing analyzing the received traffic log data in accordance with a specified 
criterio n, so as to identify those electronic messages that satisfy the criterion; 
identifying the destination of the identified electronic messages; and 
sending a message to each of the identified destinations, requesting suspension of 
delivery of the identified electronic messages. 

13. (Currently Amended) A method according to claim 12, including: 
receiving a signal identifying whether or not an identified electronic message is 

related to an electronic message virus, 

receiving data indicative of the success or otherwise of the request, and, 

in the event that the received signal identifies an electronic message to be a virus 

and the request is successful, triggering deletion of the said electronic message. 

14. (Currently Amended) A method according to claim 13, wherein^ 
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in the event that a received signal identifies an electronic message to be a virus 
and the request is unsuccessful, the method includes triggering the identifying and 
sending steps to be carried out in respect of a server corresponding to the destination of 
the identified electronic message. 

15. (Currently Amended) A method according to claim 13, wherein^ 

in the event that a received signal identifies an electronic message not to be a virus 
and the request is successful, the method includes triggering delivery of the identified 
electronic message. 

16. (Currently Amended) A method according to claim 12, including: 
receiving data identifying a mapping between users and the 

organisational organization units to which the users belong, 

displaying a plurality of images, each representative of an 
organisational organizational unit; 

outputting data identifying the users who originated the electronic messages that 
are identified to satisfy the criterion; 

identifying, from the mapping, which of the organisational organizational units 
those users belong to; and, 

inserting, on an image corresponding to the identified organisational organizational 
units, visual identifiers representative of the volume or type of identified electronic 
messages. 

17. (Currently Amended) A method according to claim 16, wherein^ 
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for those electronic messages that are identified to satisfy the criterion, the method 
includes displaying a list of users on an associated image, and for each user on the list, 
displaying details of the volume and/or type of identified electronic messages emanating 
therefrom. 

18. (Currently Amended) A method according to claim 17, including; 
inserting a link between the identified organisational organizational unit and the 

organisational organizational unit corresponding to the identified destination. 

19. (Currently Amended) A method according to claim 1, wherein; 

the criterion includes aft vat least on e, or some, of (a) type of electronic message, 
(b) size of electronic message and (c) number of electronic messages emanating from a 
user. 

20. (Currently Amended) A method of identifying electronic message activity 
within an organisation organization , the organisation organization having a plurality of 
users associated therewith, each of which is connected with an organisational organization 
unit, the method comprising: 

receiving traffic log data defining at least one message traffic characteristic 
emanating from a user relating to electronic messages sent by a user; 

analysing analyzing the received traffic log data in accordance with a specified 
criterion^-se-as to identify those electronic messages that satisfy the criterion; 
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receiving data identifying a mapping between users and the 
organisational organizational units to which the users belong, displaying a plurality of 
images, each representative of an organisational organizational unit; 

outputting data identifying the users who originated the electronic messages that 
are identified to satisfy the criterion; 

identifying, from the mapping, which of the organi s ational organizational units the 
users belong to; and 

inserting, on an image corresponding to the identified organisational organizational 
units, visual identifiers representative of the volume or type of identified electronic 
messages. 

2 1 . (Currently Amended) A method according to claim 20, wherein; 

the criterion includes aft yat least one , or som e , of (a) type of electronic message, 
(b) size of electronic message and £c) number of electronic messages emanating from a 
user. 

22. (Currently Amended) ATangible storage media containing a computer 
program, or a suite of computer programs, comprising a set of instructions to cause a 
computer, or a suite of computers, to perform the method according to claim 12. 

23. (Currently Amended) A server configured to send outgoing electronic 
messages on behalf of terminals connected thereto and to deliver incoming electronic 
messages to the terminals, each terminal being accessed by one or more users, the server 
comprising: 
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logging means arranged to generate traffic log data relating to one or more traffic 
characteristics associated with electronic messages; and, 

analysing analyzing means to amlyseanalyze the received traffic log data in 
accordance with a specified criterion, so as to identity those electronic messages that 
satisfy the criterion. 

24. (Currently Amended) A server according to claim 23, the server 
comprising; 

identifying means arranged to identify the destination of the identified electronic 
messages; and, 

processing means arranged to send a message to each of the identified 
destinations, requesting suspension of delivery of the identified electronic messages. 

25. (Currently Amended) A server according to claim 1, the server being 
arranged to receive authentication data from a terminal connected thereto, the 
authentication data being associated with one or more electronic messages, the server 
having; 

a comparison stage configured to make a comparison between the log data relating 
to an identified message and the authentication data associated with that message, and 

the processing means being arranged to execute a decision to send a suspension 
request to the identified destination of that message in dependence on the comparison 
made by the comparison stage. 

26. (Currently Amended) A server according to claim 25, wherein: 
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the authentication data is received in encrypted form, the comparison stage being 
configured to decrypt the encrypted authentication data and to compare the decrypted 
data with the log data. 

27. (Currently Amended) A terminal for sending and receiving electronic 
messages to and from a server according to claim 25, wherein the terminal has an 
interface, the interface having; 

a user input for receiving send instructions to send one or more specified 
electronic messages to a server, 

the user input being configured to receive a confirmation input from the user to 
confirm the send instructions and 

wherein in response to the confirmation input, the terminal is configured to send 
the specified electronic messages towards the server and to send authentication data 
associable with the specified electronic messages. 

28. (Currently Amended) A terminal according to claim 27 wherein; 

the terminal is configured to detect whether a criterion relating to the specified 
electronic message is met, and to request a confirmation input from a user at the user 
interface in response to the criterion being met. 

29. (Currently Amended) A terminal according to claim 27, wherein; 

the terminal is configured to transmit the authenticating data in encrypted form. 
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30. (Currently Amended) A eame rtangible storage medium having a computer 
program stored thereon, the computer program being executable on a terminal so as to 
cause the terminal to operate according to the terminal specified claim 27. 

3 1 . (Currently Amended) A eame rtangible storage medium having a computer 
program thereon for sending and receiving electronic messages, the program being 
executable on a terminal having a user interface, the computer program being configured 
to perform the following steps when executed: 

(a) invite a user to input at the user interface send instructions for sending one or 
more electronic messages; 

(b) determine if atraffic log data meets a predetermined criterion relating to the 
electronic messages4s-met; 

(c) if the criterion is met, invite the user to input at the user interface a 
confirmation input to confirm the send instructions; 

(d) upon receipt of the confirmation input, transmit the electronic messages from 
the terminal ; and 

(e) transmit authentication data associable with the transmitted electronic message 

(s). 

32. (Currently Amended) A carrier having an improvemen t tangible storage 
medium containing a computer program, the improv e m e nt computer program being 
executable on a terminal having electronic messaging software running thereon^-so-as to 
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reduce the likelihood of a computer virus using the messaging software to propagate from 
the terminal, 

the messaging software being configured to invite the user to input at the user 
interface send instructions for sending one or more specified electronic messages, and in 
response to the send instructions, to transmit the messages from the terminal, 

the improvem e nt said computer program being configured when executed to; 

(a) invite a user to input confirmation instructions at the user interface to 
confirm the send instructions; 

(b) only permit the user to send electronic messages once the user has input 
the confirmation instructions; and, 

(c) upon receipt of the confirmation instructions, cause the terminal to 
transmit therefrom authentication data associable with the specified messages. 

33. (Currently Amended) A carrier according to claim 3 1 , wherein^ 
the authentication data is transmitted encrypted form. 

34. (Currently Amended) A carrier according to claim 31, wherein: 

the computer program thereon is configured, when executed, to request a user to 
input password data as part of the confirmation instructions, and to only permit the 
terminal to send authentication data once the password data has been input by the user. 

35. (Currently Amended) A server according to claim 1, wherein the criterion 
is met if-the log data relating to a target electronic message indicates that a threshold 
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number of electronic messages and/or a threshold data volume originates from a common 
terminal or user, in a time interval during which the target electronic message was sent. 

36. (Currently Amended) A server configured to send outgoing electronic 
messages on behalf of terminals connected thereto and to deliver incoming electronic 
messages to the terminals, each terminal being accessed by one or more users, the server 
comprising: 

receiving means arranged to generate or receive traffic log data relating to such 
electronic messages; 

analvsing analvzing means arranged to amlyseanalyze the traffic log data in 
accordance with a specified criterionrse-as to identify those electronic messages that 
satisfy the criterion; 

identifying means arranged to identify the destination of the identified electronic 
messages; and 

processing means arranged to send a message to each of the identified 
destinations, requesting suspension of delivery of the identified electronic messages. 
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